changeset 30052:99c9595e14a2

Fix two related on-disconnect double frees. _purple_connection_destroy calls purple_proxy_connect_cancel_with_handle(gc), and both of these plugins use gc as the handle for their connection attempts. Their respective close() functions /also/ try to cancel the connection attempts, which leads to a double-free. One of these was reported by mati, the other by T_X.
author Paul Aurich <paul@darkrain42.org>
date Sun, 28 Mar 2010 18:08:38 +0000
parents 3b24193663bc
children 0646207f360f 7eb8c738634a
files libpurple/protocols/bonjour/jabber.c libpurple/protocols/qq/qq.c
diffstat 2 files changed, 6 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/libpurple/protocols/bonjour/jabber.c	Sat Mar 27 21:29:18 2010 +0000
+++ b/libpurple/protocols/bonjour/jabber.c	Sun Mar 28 18:08:38 2010 +0000
@@ -1185,6 +1185,9 @@
 		for (l = buddies; l; l = l->next) {
 			BonjourBuddy *bb = purple_buddy_get_protocol_data((PurpleBuddy*) l->data);
 			if (bb != NULL) {
+				/* Any ongoing connection attempt is cancelled
+				 * by _purple_connection_destroy */
+				bb->conversation->connect_data = NULL;
 				bonjour_jabber_close_conversation(bb->conversation);
 				bb->conversation = NULL;
 			}
--- a/libpurple/protocols/qq/qq.c	Sat Mar 27 21:29:18 2010 +0000
+++ b/libpurple/protocols/qq/qq.c	Sun Mar 28 18:08:38 2010 +0000
@@ -221,6 +221,9 @@
 		qd->connect_watcher = 0;
 	}
 
+	/* This is cancelled by _purple_connection_destroy */
+	qd->conn_data = NULL;
+
 	qq_disconnect(gc);
 
 	if (qd->redirect) g_free(qd->redirect);